Chapter 7. Intelligent actuators

In automotive industry several communication networks are used parallel, see [90]. In this subsection the CAN technology is detailed because it is the most widespread standard in the field of powertrain applications.

The Controller Area Network (CAN) is a serial communications protocol which efficiently supports distributed real-time control with a very high level of security. Its domain of application ranges from high-speed networks to low-cost multiplex wiring. In automotive electronics, electronic control units (ECU) are connected together using CAN and changing information with each-other by bitrates up to 1 Mbit/s.

CAN is a multi-master bus with an open, linear structure with one logic bus line and equal nodes. The number of nodes is not limited by the protocol. Physically the bus line (Figure 6) is a twisted pair cable terminated by termination network A and termination network B. The locating of the termination within a CAN node should be avoided because the bus lines lose termination if this CAN node is disconnected from the bus line. The bus is in the recessive state if the bus drivers of all CAN nodes are switched off. In this case the mean bus voltage is generated by the termination and by the high internal resistance of each CAN nodes receiving circuitry. A dominant bit is sent to the bus if the bus drivers of at least one unit are switched on. This induces a current flow through the termination resistors and, consequently, a differential voltage between the two wires of the bus. The dominant and recessive states are detected by transforming the differential voltages of the bus into the corresponding recessive and dominant voltage levels at the comparator input of the receiving circuitry.

The CAN standard (see [91], [92]) gives specification which will be fulfilled by the cables chosen for the CAN bus. The aim of these specifications is to standardize the electrical characteristics and not to specify mechanical and material parameters of the cable. Furthermore the termination resistor used in termination A and termination B will comply with the limits specified in the standard also.

Besides the physical layer the CAN standard also specifies the ISO/OSI data link layer as well. CAN uses a very efficient media access method based on the arbitration principle called "Carrier Sense Multiple Access with Arbitration on Message Priority". Summarizing the properties of the CAN network the CAN specifications are as follows:

These properties enable the CAN technology to use in automotive environment and especially in safety critical systems. Although the limitations of CAN recently induced the development of new bus systems like FlexRay with higher bandwidth, deterministic time-triggered operation and fault-tolerant architecture, CAN still will be inevitable in the automotive industry for the next decade.

From safety point of view we can categorize the intelligent actuators into two groups, depending on whether a failure in the system may result is human injury and/or severe damage:

These safety aspects have deterministic effect on the subsystem architecture. While in case of safety critical systems a fault tolerant architecture is a must requirement, there is no or limited backup function is required for non-safety critical systems.

The required safety level can be traced back to the risk analysis of a potential failure. During risk analysis the probability of a failure and the severity of the outcome are taken into consideration. Based on this approach the risk of a failure can be categorized into layers, like low, medium or high as can be seen on the following figure:

The IEC61508 standard stands for “Functional safety of electrical/electronic/programmable electronic (E/E/PE) safety-related systems” The IEC61508 standard provides a complex guideline for designing electronic systems, where the concept is based on

Source: IEC61508 “Functional safety of electrical/electronic/programmable electronic (E/E/PE) safety-related systems”

Dependability summarizes a system’s functional reliability, meaning that a certain function is at the driver’s disposal or not. There are different aspects of dependability, first of all availability, meaning that the system should deliver the function when it is requested by the driver (e.g. the vehicle should decelerate when the driver pushes the brake pedal). The subsequent aspect is reliability, indicating that the delivered service is working as requested (e.g. the vehicle should decelerate more as the driver pushes the brake pedal more). Safety in this manner implies that the system that provides the function operates without dangerous failures. Functional security ensures that the system is protected against accidental or deliberate intrusion (this is more and more important since vehicle hacking became an issue recently [93][94][95]). There are additional important characteristics can be defined as a part of dependability like maintainability, reparability that has real add value during operation and maintenance. The figure below shows a block diagram describing the characteristics of functional dependability.

Generally the acceptable risk hazard is below the tolerable risk limit, defined by market (end-user requirements expressed by the OEMs). The probability of a function loss should be inversely related to the probability of the safety level of the function. For example in the aviation industry (Airbus A330/A340) the accepted probability of a non-intended flap control is P < 1*10-9 (Source: Büse, Diehl). Such high requirements for the availability can only be fulfilled by so called fault-tolerant systems. This is the reason why automotive safety critical systems must be fault tolerant; meaning that one failure in the system may not reduce the functionality. Please remember the two independent circuits of the traditional hydraulic brake system, having the intension that if one circuit fails, there is still brake performance (but in this case not 100%!) in the vehicle. Such systems are called 2M systems, since there are two independent mechanical circuits in the architecture.

In today’s electronically controlled safety critical systems there are usually at least one mechanical backup system. As a result, the probability of a function loss with a mechanical backup (1E+1M - one electrical system and one mechanical system architecture) can be as low as P < 1*10-8, while the probability of a function loss without mechanical backup (1E - architecture alone) is around P < 1*10-4. The objective of the safety architectural design is to provide around P < 1*10-8 level of dependability (availability) in case of 2E system architectures (electronic system with electronic backup) without mechanical backup.

Safety architectural design means consideration of all potential failures and relevant design answers to all such issues. The easiest answer to produce a fault tolerant system, so as to avoid that one failure may result is a complete function loss is to duplicate the system and extend it with arbitration logic. In case of a redundant system extended it with arbitration logic the subcomponents are not simply duplicated, but there is a coordinating control above to enable (or disable) output control based on the comparison of the two calculated outputs of the redundant subsystems. In case both subsystems have the same output (and none of them identified errors) the overall system output is enabled. Even in case of redundancy there are several tricks to enhance the safety level of a system. For example safety engineers soon realized that it makes great difference if the redundant subsystems are composed of physically the same (hardware and software) or physically different components. Early solutions just used two physically same components for redundancy, but today the different hardware and software components are predefined requirements to eliminate the systematic failures caused by design and/or software errors.

Redundancy and supervision are not only issue in case of fault tolerant architectures, safety focused approach can also be observed in ECU (electronic Control Unit) design. Early and simple ECUs were only single processor systems; while later - especially in brake system control – the dual processor architectures became widespread. Initially these two processors were the same microcontrollers (e.g. Intel C196) with the same software (firmware) inside. In this arrangement both microcontrollers have access to all of the input signals, they individually perform internal calculations based on the same algorithm each resulting in a calculated output command. These two outputs then are compared to each-other and only in case both controllers came to the same result (without any errors identified) the ECU output is controlled. This so called A-A processor architecture was a significant step forward in safety (compared to single processor systems), but safety engineers quickly understood, that this approach does not prevent system loss in case of systematic failures (e.g. microcontroller hardware bug or software implementation error). This is the reason why the A-B processor architecture was later introduced. In the A-B processor approach the two controllers physically must differ from each other. Usually the A controller is bigger and more powerful (bigger in memory capacity, having more calculation power) than the B controller. The A controller is often identified as “main” controller, while B controller is often referred to as “safety” controller, since in this task distribution the A controller is responsible for the functionality, while the B controller has only tasks for checking the A controller. B controller has access also to the inputs of the A controller, but the algorithms inside are totally different. B controller also does calculations based on the input signals, but these are not detailed calculations, only basic calculations on a higher level “like rule of thumb” checking. The different hardware and the different software algorithms in A-B processor design have proved its superior reliability.

Besides the different controller architectures there are also different kinds of dedicated supervisory electronics used extensively by the automotive electronics industry. The most significant ones are the so called “watch-dog” circuits. The watch-dogs are generally separate electronic devices that have a preset internal alarm timer. If the watch-dog does not get an “everything is OK” signal from the main controller within the predefined timeframe, the watch-dog generates a hardware reset of the whole circuitry (ECU). There are not only simple watch-dog integrated circuits available, but also more complex ones (e.g. windowed watch-dogs), however the theory of operation are basically the same.

Up to now fault-tolerant requirements were only observed from functional point-of-view, while a simple failure in the energy supply system can also easily result in function loss. That is why a fail-safe electrical energy management subsystem is a mandatory requirement for safe electrical energy supply of safety related drive-by-wire subsystems (e.g. steer-by-wire, brake-by-wire). The following figure shows a block diagram of a redundant energy management architecture (where PTC stands for Powertrain Controller, SbW stands for Steer by Wire and BbW stands for Brake by Wire subsystems).

The steering system in today’s road vehicles uses mechanical linkage between the steering wheel and the steered wheels. The driver’s steering input (demand) is transmitted by a steering shaft through some type of gear reduction mechanism to generate a steering motion at the front wheels.

In the present day automobiles, power assisted steering has become a standard feature. Electrically power assisted steering has replaced the hydraulic steering aid which has been the standard for over 50 years. A hydraulic power assisted steering (HPAS) uses hydraulic pressure supplied by an engine-driven pump. Power steering amplifies and supplements the driver-applied torque at the steering wheel so that the required drive steering effort is reduced. The recent introduction of electric power assisted steering (EPAS) in production vehicles eliminates the need of the former hydraulic pump, thus offering several advantages. Electric power assisted steering is more efficient than conventional hydraulic power assisted steering, since the electric power steering motor only needs to provide assist when the steering wheel is turned, whereas the hydraulic pump must run continually. In the case of EPAS the assist level is easily adjustable to the vehicle type, road speed, and even driver preference. An added benefit is the elimination of environmental hazard posed by leakage and disposal of hydraulic power steering fluid. (Source: [96])

Although aviation industry proved that the fly-by-wire systems can be as reliable as the mechanical connection, automotive industry steps forward with intermediate phases like EPAS (electronically power assisted steering) as mentioned above and SIA (superimposed actuation) to be able to electronically intervene into the steering process.

Electric power steering (EPAS) usually consists of a torque sensor in the steering column measuring the driver’s effort, and an electric actuator which then supplies the required steering support (see Figure 104 [97]).This system enables to implement such functions that were not feasible with the former hydraulic steering like automated parking or lane departure preventions.

Superimposed actuation (SIA) allows driver-independent steering input without disconnecting the mechanical linkage between the steering wheel and front axle. It is based on a standard rack-and-pinion steering system extended with a planetary gear in the steering column (see Figure 105 [98]). The planetary gear has two inputs, the driver controlled steering wheel and an electronically controlled electromotor and one output connected to the steering pinion at the front axle. The output movement of the planetary gear is determined by adding the steering wheel and the electro-motor rotation. When the electromotor is not operating, the planetary gear just passes through the rotation of the steering wheel; therefore the system also has an inherent fail silent behaviour. SIA systems may provide functions like speed dependent steering and limited (nearly) steer-by-wire functionality.

The future of driving is definitely the steer-by-wire technology. An innovative steering system allowing new degrees of freedom to implement a new human machine interface (HMI) including haptic feedback (by "cutting" the steering column, i.e. opening the mechanical connection steering wheel / steering system).

The steer-by-wire system offers the following advantages:

Instead of a mechanical connection between the steering wheel and the steered axle (steering gear) the steer-by-wire system uses full electronic control. The steer-by-wire system has an electronically controlled clutch integrated into the steering rod that enables to cut or re-establish the mechanical connection in the steering system. For safety reasons this clutch can be opened by electromagnetic power, but it closes automatically (e.g. by a mechanical spring) when the electric power is missing. When the clutch is closed the steering system operates just like a “normal” mechanical steering system, where the mechanical link is continuous from the steering wheel to the steered wheels. In case the clutch is open the mechanical link no longer exists and the driver intention is detected by special sensors installed in the steering wheel. Input signal is the angle position (or steering torque) of the steering wheel, and output signal is the position of the steered wheels. The position of the steering actuator is controlled by a comparison of the desired and the actual value, which is usually measured by redundant angle sensors.

This above described solution is a 1E+1M architecture system, representing a steer-by wire system with full mechanical backup function. A similar system was installed in the PEIT demonstrator vehicle to validate steer-by-wire functionality.

As steer-by-wire system design involves supreme safety considerations, it is not surprising that after PEIT the later HAVEit approach has extended the original safety concept with another electric control circuitry resulting in a 2E+1M architecture system. The following figure describes the safety mechanism of a steer-by-wire clutch control by introducing two parallel electronic control channels with cross checking functions [6].

Steer-by-wire systems also raise new challenges to be resolved, like force-feedback or steering wheel end positioning. In case of the mechanical steering the driver has to apply torque to the steering wheel to turn the front wheels either to left or right directions, the steering wheel movement is limited by the end positions of the steered wheels and the stabilizer rod automatically turns back the steering wheel into the straight position. In steer-by-wire mode when the clutch is open there is no direct feedback from the steered wheels to the steering wheel and without additional components there would be no limit for turning the steering wheel in either direction. Additionally there has to be a driver feedback actuator installed in the steering wheel to provide force (torque) feedback to the driver.

Mainly due to legal legislation traced back to safety issues steer-by-wire systems are not common on today’s road vehicles however the technology to be able to steer the wheels without mechanical connection exists since the beginning of the 2000s. Up to now only Infiniti introduced a steer-by-wire equipped vehicle into the market in 2013, but its steer-by-wire system contains a mechanical backup with a fail-safe clutch described later. The Nissan system debuted under the name of Direct Adaptive Steering technology, see [99]. It uses three independent ECUs for redundancy and a mechanical backup. There is a fail-safe clutch integrated to the system, which is open during electronically controlled normal driving situations (steer-by-wire driving mode), but in case of any fault detection the clutch is closed, establishing a mechanical link from the steering wheel to the steered axle, working like a conventional, electrically assisted steering system. Figure 108 illustrates DAS system architecture with the system components.

The earliest throttle-by-wire system in the automotive industry appeared on a 7 series BMW in the end of the 80s. In this case there is no mechanical Bowden coming from the accelerator pedal to the throttle valve on the engine, but there is a position sensor and a transmitter placed in the gas pedal unit, and the throttle valve is positioned by using an electric motor. A throttle-by-wire system architecture consists of a pedal module to translate the driver input to an electrical signal for the engine control module (ECM) and the electronic throttle body (ETB). The ETB receives the electrical signal command from the engine control module (ECM) and moves the throttle valve to allow airflow into engine. The ETB provides feedback of its relative position as measured by the throttle position sensor (TPS) from the throttle to the ECM.

Electronic throttle control enables the integration of features such as cruise control, traction control, stability control, pre-crash systems and others that require torque management, since the throttle can be moved irrespective of the position of the driver's accelerator pedal. Throttle-by-wire provides some benefit in areas such as air-fuel ratio control, exhaust emissions and fuel consumption reduction, and also works jointly with other technologies such as gasoline direct injection.

Brake-by-wire systems were initially introduced in the heavy duty commercial vehicle segment in the mid of the 90s. The so called EBS (Electronic Brake Control) systems are rather electronically controlled pneumatic brake systems, since the energy for braking is supplied by compressed air. Ten years later in the passenger car domain Daimler and Toyota started to use such systems, with limited success. These systems are still classic hydraulic wheel brakes where the energy for braking is supplied by an electro-hydraulic pump. The greatest advantage of an electronically controlled brake system is the capability of braking each wheel according to the corresponding friction situation under the wheels. The brake-by-wire systems are fully controlled by electronic circuits and electronic/electric commands/signals. Actuation however still pneumatic in case of commercial vehicles and hydraulic in case a passenger cars. The future brake-by-wire systems may be composed of fully electronic brakes where the hydraulic system is replaced by mechatronic actuators and the energy for braking also comes from electric energy, using so called EMB (Electro-Mechanic Brake) or EWB (Electronic Wedge Brake) applications. The theory of the electronically controlled braking system is closely linked together with Prof. Egon-Christian Von Glasner who designed the first architecture of an EBS in 1987 with his partner, Micke[100].

The torque and power of the internal combustion engine vary significantly depending on the engine revolution. The task of the transmission system mounted between the engine and the driven wheels is to adapt the engine torque according to the actual traction requirement. From highly automated driving point-of-view the automotive transmission system can be classified into two categories, namely the manual transmission and the automatic transmission. Manual transmissions cannot be integrated into a highly automated vehicle, there has to be at least an automated manual transmission or another kind of automatic transmission as will be explained later in this section.

In case of the manual transmission system, the driver has the maximum control over the vehicle; however using manual transmission requires a certain practice and experience. The manual transmission is fully mechanical system that the driver operates with a stick-shift (gearshift) and a clutch pedal. The manual transmission is generally characterized by simple structure, high efficiency and low maintenance cost.

Automatic transmission systems definitely increase the driving comfort by taking over the task of handling the clutch pedal and choosing the appropriate gear ratio from the driver. Regardless of the realization of the automatic transmission system, the gear selection and changing is done via electronic control without the intervention of the driver. There are different types of automatic transmission systems available, like